From 01933928a8275a4db92b937352cd47270a00c206 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Fri, 29 May 2026 15:48:49 +0200
Subject: [PATCH] Validate Datadog API domain in driver factory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/connector/provider/datadog.go | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkg/connector/provider/datadog.go b/pkg/connector/provider/datadog.go
index 628687ede..7b3ab9499 100644
--- a/pkg/connector/provider/datadog.go
+++ b/pkg/connector/provider/datadog.go
@@ -46,8 +46,13 @@ func datadogRegistration() *Registration {
 				return nil, fmt.Errorf("cannot read datadog connector settings: %w", err)
 			}
 
-			if s.Domain == "" {
-				return nil, fmt.Errorf("cannot create datadog driver: domain is required")
+			// Re-validate the stored domain against the fixed allow-list at
+			// the construction site (defense-in-depth). The OAuth callback
+			// validates on write, but pinning the SSRF invariant here keeps
+			// the driver safe regardless of how the connector row was
+			// populated. An empty domain also fails this check.
+			if !connector.IsValidDatadogDomain(s.Domain) {
+				return nil, fmt.Errorf("cannot create datadog driver: invalid or missing domain")
 			}
 
 			return drivers.NewDatadogDriver(c, s.Domain), nil